NFS Authentication

[mjw]

Hi!

I added an NFS Share to my PVE Cluster. As the NFS-Server (QNAP NAS) is reachable from different parts of the network I created a user on the NAS for PVE to get write access to the Shared Folder.

Adding the Share works with the Web-GUI but I see no option to set connection credentials. It also isn't mounted through fstab so I can't add the credentials there.

Trying to access the share I get the expected error: "mount error: mount.nfs: access denied by server while mounting servername.tld:/vmbackup (500)"

Is this intended or did I just not find the right option? Can I edit some config file to add the credentials or is the only way to mount the share outside of the Web-GUI (using fstab on every host) and adding the mounted folder as a Proxmox-Storage?

thanks,
mjw

 

[sdinet]

I don't think there is any way to configure authentication using the GUI. I think the NFS server and Client (proxmox) have to have the exact same credentials. The username and user ID have to be identical on both in order for authentication to work. Try that and see if it works.

 

[mjw]

Hi sdinet - and thanks for your answer.

I'm not sure if understand your suggestion. I only have the root user of the two nodes configured at the moment. You suggest I create a user named "root" with the same password (which of the two?) on my NAS and give it write permissions on the NFS Share?

 

[wbumiller]

How do you mount this nfs share usually? The only NFS authentication I know of would be krb5 which usually uses a key-tab file. The nfs(5) and mount.nfs(8) man pages don't list any user/password related mount options, and their suggestion here[1] errors with:

mount.nfs: an incorrect mount option was specified

.
Usually you'd configure your NFS server to only allow a certain subset of IPs to access the directory, and you'd either physically separate your storage network from your VM network or configure your firewall accordingly so that your VMs cannot use invalid IPs to access your NFS.

[1] http://wiki.qnap.com/wiki/Mounting_an_NFS_share_on_Ubuntu

 

[mjw]

That's the solution - thank you!

The is no authentication in NFSv3 and earlier and QNAP does not support NFSv4 yet. QNAP did also hide the NFS Host/IP restrictions well but I finally found them.

 

[sdinet]

I think with NFSv4 you can disable authentication entirely by specifying "no_root_squash,no_all_squash".